CodeSOD: Query the Contract Status

Rui recently pulled an all-nighter on a new contract. The underlying system is... complicated. There's a PHP front end, which also talks directly to the database, as well as a Java backend, which also talks to point-of-sale terminals. The high-level architecture is a bit of a mess.

The actual code architecture is also a mess.

For example, this code lives in the Java portion.

final class Status { static byte [] status; static byte [] normal = {22,18,18,18}; //snip public static boolean equals(byte[] array){ boolean value=true; if(status[0]!=array[0]) value=false; if(status[1]!=array[1]) value=false; if(status[2]!=array[2]) value=false; if(status[3]!=array[3]) value=false; return value;}}

The status information is represented as a string of four integers, with the normal status being the ever descriptive "22,18,18,18". Now, these clearly are code coming from the POS terminal, and clearly we know that there will always be four of them. But boy, it'd be nice if this code represented that more clearly. A for loop in the equals method might be nice, or given that there are four distinct status codes, maybe put them in variables with names?

But that's just the aperitif.

The PHP front end has code that looks like this:

$sql = "select query from table where id=X";$result = mysql_query($sql);// ... snip few lines of string munging on $result...$result2 = mysql_query($result);

We fetch a field called "query" from the database, mangle it to inject some values, and then execute it as a query itself. You know exactly what's happening here: they're storing database queries in the database (so users can edit them! This always goes well!) and then the front end checks the database to know what queries it should be executing.

Rui is looking forward to the end of this contract.

[Advertisement] Otter - Provision your servers automatically without ever needing to log-in to a command prompt. Get started today!